A $49 Linksys wired 4-port router is one of the best PC security investments anyone can make. No ports forwarded, no need for an incoming firewall to protect against outside threat vectors.
After seeing outgoing software firewall exception lists created by most users I'll say that at least 80% of them have no idea what they're letting out. More often than not they accidentally block iexplore.exe and can't figure out how to unblock it. 3rd party software firewalls seem to be the component that uses the most resources in the various "Internet Security" packages, AVG included.
I used to tell clients to buy a 4-port Linksys BEFSR41 and they won't see me as often, even on single user systems. But what Richard said is the most true - the best protection is an educated user.
(not that blocking IE from the Internet is a bad thing....